Packagist/drupal/core CVE-2020-13688: unknown, EPSS 0.66%

Drupal 8 and 9 have a reflected cross-site scripting (XSS) vulnerability under certain circumstances.

Action: Upgrade drupal/core to 8.8.10 or later.

composer require drupal/core:8.8.10

composer require drupal/core:8.9.6

composer require drupal/core:9.0.6

Affected

Fixed versions

Sources

• osv: DRUPAL-CORE-2020-009
• https://www.drupal.org/sa-core-2020-009

CVE-2020-13688 · published 2020-09-16T16:11:00Z · modified 2026-09-19T17:34:55Z · JSON